CVE-2017-15524 The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request.
CriticalCVSS 9.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kemptechnologies web application firewall | <= 7.2.40 | No fix listed |
References
- 20171214 ADVISORY - Kemp Load Balancers - Module Application Firewall Pack (AFP) - Web Application Firewall (WAF) does not inspect HTTP POST data - CVE-2017-15524 mailing-list
- kemptechnologies.com issue-tracking release-notes vendor-advisory
- www.pallas.com exploit issue-tracking third-party-advisory